> the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table?

Insurance. Back-ups. Bail outs. Go out of business. That ransom paid has negative externalities that manifest nationally.

You won't even be able to get private insurance if the industry has to insure against complete destruction of a given business. Are you expecting the US gov to backstop every business regardless of size against ransomware? Who is going to pay for that?

Additionally, how do you protect against the obvious opportunities for fraud and abuse (business deliberately attacks itself to collect the insurance payout, business hits their competitors to drive them out of business, etc)?

>"insure against complete destruction of a given business."

Isnt that what fire/flood insurance is for?

Fire and flood insurance protect against discrete or regional risks whereas ransomware will potentially disrupt operations globally, and actually most private insurers won't offer flood insurance to large swaths of the US because the risk has been deemed to be too high. The US gov insures against coastal flooding at GREAT expense to the tax payer.

I wonder what the biggest company is that's totally dependent on a single location (or locations in the same flood zone) and at the same time is usefully insured against such destruction.

Ports?

Take out a port, and screw an entire region.

You would be able to get affordable private insurance if you had a cyber security team.

Various providers of "cyber insurance" are right now busy getting rid of ransomware coverage because it turns out offering that isn't working for them. and yes, they do require companies to have cyber security infrastructure and audits.

That would imply that cyber security isn't effective in mitigating these attacks then, no?

It suggests it is a difficult problem to stop. As I understand it, attackers now frequently perform an initial compromise and then manually escalate privileges before launching a ransomware attack for greater impact. Alternatively, the attacker will sell privileged access to a ransomware group. This isn't someone from HR opening a malicious attachment and getting the whole company owned via eternal blue.

At least it suggests that the current standards and auditing practices are not sufficient, and apparently formulating testable requirements is difficult.

How about, companies who pay ransoms get a fine that's 10x the ransom. It slides up toward 1000x over two years. Kind of like deprecating an API slowly by decreasing its responsiveness.

Then you go out of business. That's what is supposed to happen in capitalism when you run your business badly.

Sounds like maybe not the best for people who work at the company and whose livelihoods depend on it (especially, of course, those whose purview has nothing to do with cybersecurity).

A few businesses die. The rest get the message that security matters. The ransomware industry is deprived of revenue.

This is a government agency.

https://en.wikipedia.org/wiki/Steamship_Authority

The followup controversy will be government agencies and massive companies getting "too big to fail" exemptions.

If we're allowing government agencies to fail we're in pretty crappy shape.

In which case there are no investors so just wipe all the computers and start again.

The physical ferries still exist, right? Transfer them to a new agency.